Schema Pro < 2.7.16 - Contributor+ Custom Field Access

Description The plugin does not validate post access allowing a contributor user to access custom fields on any post regardless of post type or status via a shortcode

PoC

As a contributor, add/edit a post and embed [aiosrs_pro_custom_field post_id="ANY_POST_ID" field_key="ANY_META_KEY"] and specify/guess any post ID and meta key you may want to access Save the post and preview it to disclose the post meta key value